Power supply control device

Abstract

The present invention addresses the problem of achieving quick transition to a backup state upon detection of a failure of a power supply and ensuring reliable maintenance of the backup state. In order to solve this problem, a power supply control device (1) is provided with a comparator (31), a latch circuit (32), and a microcomputer (controller 3). The comparator (31) compares a voltage of a power system, to which power of a main power supply (10) is supplied, with a threshold, detects a failure of the power system, and outputs a detection signal. The latch circuit (32) latches the detection signal and outputs a latch signal, and a specific switch (backup switch 44) that controls power supply to a load is driven by the latch signal. Upon reception of the latch signal, the microcomputer (controller 3) determines whether the detection of the failure of the power system by the comparator (31) is correct, and, when it is determined that the power system has not failed, clears the latch circuit (32) and stops the output of the latch signal.

Description

Power Supply Control Device

[0001] The present invention relates to a power supply control device.

[0002] 2. Description of the Related Art Conventionally, a power supply control device that performs backup control using a backup power supply when the main power supply fails is known, and detects power supply failure using a hardware circuit and immediately starts backup control (see, for example, Patent Document 1).

[0003] In the above-described conventional technology, when a hardware circuit detects a power failure, it outputs a fixed-width one-shot pulse to shut off the inter-system switch and put it into a backup state, and notifies a microcomputer (hereinafter sometimes referred to as "microcomputer"). When the microcomputer receives the notification of the power failure, it outputs a drive signal to maintain the inter-system switch in the shut-off state, thereby maintaining the backup state. While maintaining the backup state, the microcomputer executes a process to determine whether the system has a ground fault.

[0004] Japanese Patent Application Laid-Open No. 2023-043533

[0005] However, in the above-described conventional technology, the microcontroller takes over the backup state upon receiving a notification from the hardware circuit. Therefore, if the notification from the hardware circuit to the microcontroller is delayed or fails for some reason, such as noise, the microcontroller cannot take over the backup state. As a result, if the microcontroller is unable to take over the backup state before the pulse period of the one-shot pulse from the hardware circuit ends, it will return from the backup state to the normal state.

[0006] The present invention has been made in consideration of the above, and aims to provide a power supply control device that can quickly transition to a backup state when a power supply failure is detected and can reliably maintain the backup state.

[0007] In order to solve the above problems and achieve the object, in the present invention, a power supply control device includes a comparator, a latch circuit, and a microcomputer. The comparator compares the voltage of a power system to which power from a main power supply is supplied with a threshold value to detect a failure in the power system and output a detection signal. The latch circuit latches the detection signal and outputs a latch signal, and the latch signal drives a specific switch that controls the power supply to a load. When the microcomputer receives the latch signal, it determines whether the comparator's detection of the power system failure is correct, and if it determines that the power system is not failing, it clears the latch circuit and stops outputting the latch signal.

[0008] According to the present invention, when a power system failure is detected by the comparator, the latch circuit instantly outputs a latch signal to drive the specific switch, enabling a rapid transition to a backup state. Furthermore, after outputting the latch signal, the latch circuit continues to output the latch signal until it is cleared, thereby maintaining the backup state, thereby ensuring that the backup state is maintained.

[0009] FIG. 1 is an explanatory diagram showing an example of the configuration of a control system according to the first embodiment. FIG. 2 is an explanatory diagram showing an example of the operation of a power supply control device and the like according to the first embodiment. FIG. 3 is an explanatory diagram showing an example of the operation of a power supply control device and the like according to the first embodiment. FIG. 4 is an explanatory diagram showing an example of the operation of a power supply control device and the like according to the first embodiment. FIG. 5 is a diagram showing an example of the configuration of a failure detection device according to the first embodiment. FIG. 6A is a time chart of processing executed by a power supply control device and the like. FIG. 6B is a time chart of processing executed by a power supply control device and the like. FIG. 7 is a flowchart showing an example of processing executed by a controller of a power supply control device according to the first embodiment. FIG. 8 is an explanatory diagram showing an example of the configuration of a control system according to the second embodiment. FIG. 9 is an explanatory diagram showing an example of the operation of a power supply control device according to the second embodiment. FIG. 10 is an explanatory diagram showing an example of the operation of a power supply control device according to the second embodiment. FIG. 11 is an explanatory diagram showing an example of the operation of a power supply control device according to the second embodiment. FIG. 12 is an explanatory diagram showing an example of the operation of a power supply control device according to the second embodiment. FIG. 13 is a diagram showing an example of the configuration of a failure detection device according to the second embodiment. FIG. 14A is a time chart of processing executed by a power supply control device and the like according to the second embodiment. Fig. 14B is a time chart of processing executed by the power supply control device etc. according to the second embodiment. Fig. 15 is a flowchart showing an example of processing executed by the controller of the power supply control device according to the second embodiment.

[0010] Hereinafter, an embodiment of a power supply control device will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the following embodiment. The power supply control device according to the embodiment is installed in an electric vehicle with an automatic driving function, a hybrid vehicle, or an internal combustion engine vehicle.

[0011] [1. First Embodiment] [1-1. Configuration of Control System] Fig. 1 is an explanatory diagram showing an example configuration of a control system 100 according to a first embodiment. As shown in Fig. 1, the control system 100 according to the embodiment includes a power supply control device 1, a main power supply 10, and an automatic operation control device 60. The power supply control device 1 is also electrically connected to a first load 101, a second load 102, and a third load 103.

[0012] The first load 101 is connected between the main power supply 10 and the power supply control device 1. The first load 101 includes, for example, a display, an air conditioner, audio, video, various lights, etc. More specifically, the first load 101 includes an electrical load (general load) that is not related to the running of the vehicle itself.

[0013] The second load 102 is connected between the main power supply 10 and the power supply control device 1, and is also connected to a backup switch 44 of the power supply control device 1, which will be described later. The second load 102 includes, for example, an electric brake device, an electric accelerator device, etc. In other words, the second load 102 includes an electric load required when the vehicle is running, and more specifically, an electric load (running load) required during normal operation including manual operation, and during automatic operation. The second load 102 is supplied with power directly from the main power supply 10 via the line 80, and is also supplied with power from the backup power supply 20 via the backup switch 44. The second load 102 is an example of a load.

[0014] The third load 103 is connected to the power supply control device 1. The third load 103 includes, for example, a steering device. In other words, the third load 103 includes an electrical load required when the vehicle is traveling, and more specifically, includes an electrical load (travel load) required during normal driving including manual driving and during automatic driving. Note that the second load 102 and the third load 103 are loads to which power is supplied when evacuation travel control is performed by automatic driving in the event of a power failure, as described below. Furthermore, although specific devices are shown above for the first to third loads 101 to 103, these are merely examples and are not limiting.

[0015] The main power supply 10 includes a DC / DC converter (hereinafter referred to as "DC / DC 11") and a lead battery (hereinafter referred to as "PbB 12"). Note that the battery of the main power supply 10 may be any secondary battery other than the PbB 12.

[0016] The DC / DC converter 11 is connected to a generator (not shown) and a high-voltage battery (not shown) with a higher voltage than the PbB 12, and steps down the voltages of the generator and the high-voltage battery and outputs the stepped-down voltage to the main power supply system line 70. The generator is, for example, an alternator that converts the kinetic energy of a running vehicle into electricity to generate power. The high-voltage battery is, for example, a battery for driving the vehicle that is installed in an electric vehicle or a hybrid vehicle.

[0017] When the main power supply 10 is installed in an engine vehicle, an alternator (generator) is provided instead of the DC / DC converter 11. The DC / DC converter 11 charges the PbB 12 and a backup power supply 20 (described later). The main power supply 10 also supplies power to a plurality of electrical loads installed in the vehicle, namely, first to third loads 101 to 103.

[0018] The automatic driving control device 60 is connected to the power supply control device 1. The automatic driving control device 60 is a device that controls automatic driving of a vehicle. The automatic driving control device 60 causes the vehicle to run in automatic driving mode, for example, by operating a second load 102 and a third load 103. Furthermore, if, for example, a main power supply system line 70 including the main power supply 10 fails, the automatic driving control device 60 can execute fail-safe driving control (FOP (fail-operation)) using the second load 102 and the third load 103. Fail-safe driving means, for example, driving the vehicle to a safe place and stopping it.

[0019] The power supply control device 1 is a device that controls the power supply to the second load 102 and the third load 103. The power supply control device 1 includes a controller 3, a backup power supply 20, a failure detection device 30, first to third switches 41 to 43, a backup switch 44, and a DC / DC converter 45 (hereinafter referred to as "DC / DC 45").

[0020] The backup power supply 20 is a backup power supply in the event that the main power supply 10 is unable to supply power. The backup power supply 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). Note that the battery of the backup power supply 20 may be any secondary battery other than the LiB21.

[0021] The failure detection device 30 detects a failure of the main power supply 10. Examples of failures of the main power supply 10 include a ground fault in the main power supply system line 70 that includes the main power supply 10. The failure detection device 30 is connected to the main power supply system line 70. The failure detection device 30 detects a failure of the main power supply 10, for example, when the voltage of the main power supply system line 70 that includes the main power supply 10 falls below a preset ground fault threshold. The detailed configuration of the failure detection device 30 will be described later with reference to FIG. 5 .

[0022] The first switch 41 is provided on the main power supply system line 70. More specifically, the first switch 41 is provided on the main power supply system line 70 between a connection point 71 to which the first load 101 is connected and the third load 103. The first switch 41 is provided on the main power supply system line 70 between a connection point 72 to which the second load 102 is connected and the third load 103. The first switch 41 is provided on the main power supply system line 70 between a connection point 73 to which the failure detection device 30 is connected and the third load 103. In other words, the first switch 41 is provided on the power path between the main power supply 10 and the third load 103 and is a switch that can connect and disconnect (disconnect) this power path. The first switch 41 is controlled by the controller 3. For example, the first switch 41 is turned on during normal operation, including manual operation, and turned off during automatic operation and in the event of a power failure.

[0023] The DC / DC converter 45 is connected in parallel with the first switch 41. The DC / DC converter 45 is configured to be able to step up or step down the voltage output from the main power supply 10. The second switch 42 is connected in series with the DC / DC converter 45. The second switch 42 is controlled by the controller 3. For example, the second switch 42 is turned off during normal operation including manual operation, and turned on during automatic operation and in the event of a power failure.

[0024] The third switch 43 is provided between the backup power supply 20 and the second load 102. In other words, the third switch 43 is provided in a power path between the backup power supply 20 and the second load 102 and is a switch that can connect and disconnect this power path. The third switch 43 is also connected to a connection point 74 between the DC / DC converter 45 and the second switch 42. The third switch 43 is controlled by the controller 3. For example, the third switch 43 functions as a system main relay and is always on, including during normal operation, automatic operation, and power failure.

[0025] The backup switch 44 is provided between the backup power supply 20 and the second load 102. In other words, the backup switch 44 is provided in the power path between the backup power supply 20 and the second load 102 and is a switch that can connect and disconnect this power path. The backup switch 44 is also connected to a connection point 74 between the DC / DC converter 45 and the second switch 42 and a connection point 75 between the DC / DC converter 45 and the third switch 43. The backup switch 44 is controlled by the controller 3 and the failure detection device 30. For example, the backup switch 44 is turned off during normal operation, including manual operation, and during automatic operation, and turned on in the event of a power failure. The on / off operation of the backup switch 44 by the controller 3 and the failure detection device 30 will be described in detail later. The backup switch 44 is also an example of a specific switch that controls the power supply to the second load 102, which is a load.

[0026] The power supply control device 1 includes a voltage sensor 51. The voltage sensor 51 is provided on the main power supply system line 70. The voltage sensor 51 detects the voltage of the main power supply system line 70, which includes the main power supply 10, and outputs the detection result to the controller 3.

[0027] The controller 3 includes a microcomputer having a central processing unit (CPU), read only memory (ROM), random access memory (RAM), and various other circuits.

[0028] The controller 3 may be configured in part or in whole using hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The controller 3 is an example of a microcomputer.

[0029] The controller 3 controls the operations of the first to third switches 41 to 43, the backup switch 44, the malfunction detection device 30, etc. by the CPU executing a program stored in the ROM using the RAM as a work area.

[0030] The controller 3 also acquires information indicating the remaining charge of the backup power supply 20 from the backup power supply 20 via the status monitoring line 23. The information indicating the remaining charge of the backup power supply 20 is, for example, the SOC (State Of Charge) of the LiB 21.

[0031] The LiB 21 has a maximum remaining charge when its SOC is 100%. The LiB 21 has no remaining charge when its SOC is 0%. The controller 3 monitors the SOC of the LiB 21, and when the SOC falls below a specified value that is the criterion for starting charging, the controller 3 charges the backup power supply 20 using power from the main power supply 10.

[0032] The controller 3 is mounted on a vehicle having an automatic driving function, and performs fail-safe control (described later) to supply power from the backup power supply 20 to a load (e.g., a second load 102 and a third load 103) in the event of a failure of the main power supply system line 70 including the main power supply 10.

[0033] [1-2. Example of operation of power supply control device, etc.] Next, the operation of the power supply control device 1, etc. according to the first embodiment will be described with reference to Figures 2 to 4. Figures 2 to 4 are explanatory diagrams showing an example of operation of the power supply control device 1, etc. according to the first embodiment.

[0034] [1-2-1. Operation During Normal Driving] During normal driving, including manual driving, with the ignition switch (IG) of the vehicle turned on, the controller 3 controls the first to third switches 41 to 43 and the backup switch 44, as shown in FIG. 2 .

[0035] Specifically, the controller 3 turns on the first switch 41 and the third switch 43. The controller 3 turns off the second switch 42 and the backup switch 44. This allows the power supply control device 1 to supply power from the main power supply 10 to the first load 101, the second load 102, and the third load 103. Furthermore, when the SOC of the LiB 21 is equal to or lower than a specified value, the controller 3 can supply the power of the main power supply 10 to the backup power supply 20 while stepping up or down the voltage using the DC / DC converter 45, thereby charging the backup power supply 20.

[0036] [1-2-2. Operation During Automatic Driving] During automatic driving, the controller 3 turns on the second switch 42 and the third switch 43, as shown in FIG. 3 . The controller 3 turns off the first switch 41 and the backup switch 44. This allows the power supply control device 1 to supply power from the main power supply 10 to the first load 101 and the second load 102. The power supply control device 1 can also supply power from the main power supply 10 to the third load 103 while boosting the power using the DC / DC converter 45. When the SOC of the LiB 21 is equal to or lower than a specified value, the controller 3 can supply the power from the main power supply 10 to the backup power supply 20 while boosting or lowering the power using the DC / DC converter 45, thereby charging the backup power supply 20.

[0037] [1-2-3. Operation in the Event of Failure] In the control system 100, the main power supply 10 may fail due to a ground fault or other problem in the main power supply system line 70 including the main power supply 10. When the main power supply 10 fails, the control system 100 including the controller 3 performs fail-safe control to supply power from the backup power supply 20 to the load.

[0038] Specifically, as shown in Fig. 4, when the main power supply 10 fails, a signal (a latch signal, described later) is output from the failure detection device 30 that detected the failure, and the backup switch 44 is turned on. This latch signal is also output to the controller 3. The controller 3, having received the latch signal, turns on the second switch 42 and the third switch 43. The controller 3 turns off the first switch 41. As a result, power is supplied from the backup power supply 20 to the second load 102 and the third load 103. In other words, the control system 100 including the controller 3 is in a backup state. Note that the detected failure of the main power supply 10 may be a transient voltage drop, and therefore it can be said that the failure detection device 30 has provisionally determined that a failure has occurred in the main power supply 10.

[0039] The controller 3 notifies the automatic driving control device 60 that the main power supply 10 has failed and that fail-safe control by the backup power supply 20 has started. When the automatic driving control device 60 is notified that fail-safe control by the backup power supply 20 has started, it starts a fail-safe driving control (FOP) by automatic driving, and for example drives the vehicle to a safe place and stops it.

[0040] [1-3. Example of the configuration of the malfunction detection device] Next, an example of the configuration of the malfunction detection device 30 of the power supply control device 1 according to the first embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the configuration of the malfunction detection device 30 according to the first embodiment.

[0041] As shown in FIG. 5 , the failure detection device 30 includes a comparator 31, a latch circuit 32, and an OR logic circuit 33. The comparator 31 detects a failure of the main power supply 10 and outputs a detection signal. Specifically, the comparator 31 is a comparator that compares the voltage of the main power supply system line 70, which includes the main power supply 10 (the voltage detected by the voltage sensor 51), with a ground fault threshold. When the voltage of the main power supply system line 70 falls below the ground fault threshold, the comparator 31 detects a power supply failure and outputs a detection signal to the latch circuit 32. In other words, the comparator 31 makes a provisional determination of a power supply failure. In this way, the comparator 31 compares the voltage of the main power supply system line 70 (an example of a power system) to which power from the main power supply 10 is supplied with the ground fault threshold (an example of a threshold), detects a power system failure, and outputs a detection signal.

[0042] The latch circuit 32 latches (holds) the detection signal input from the comparator 31 and outputs the latch signal to the OR logic circuit 33. The OR logic circuit 33 outputs the latch signal from the latch circuit 32 as a connection signal to the backup switch 44, thereby connecting the backup switch 44. In other words, the latch circuit 32 drives (turns on) the backup switch 44 via the OR logic circuit 33 using the latch signal.

[0043] As described above, the failure detection device 30 according to this embodiment is configured by a hardware circuit including the comparator 31 and the latch circuit 32. As a result, in this embodiment, when a failure of the main power supply 10 is detected, the backup switch 44 can be quickly driven (connected). In other words, in this embodiment, when a failure of the main power supply 10 is detected, the system can quickly transition to a backup state.

[0044] The latch circuit 32 also outputs a latch signal to the controller 3. Upon receiving the latch signal, the controller 3 makes a final determination as to whether the failure of the main power supply 10 has occurred. Specifically, the controller 3 makes a final determination as to whether the failure of the main power supply 10 detected by the failure detection device 30 is a genuine failure or an erroneous detection caused by a temporary voltage drop or the like. In other words, the controller 3 makes a final determination as to whether the detection of the power system failure by the comparator 31 is correct.

[0045] For example, the controller 3 determines whether the voltage of the main power supply system line 70, which includes the main power supply 10, is equal to or lower than the ground fault threshold based on the output of the voltage sensor 51 (see FIG. 1 ). In other words, the controller 3 determines whether the main power supply 10 has failed. If the voltage of the main power supply system line 70 remains equal to or lower than the ground fault threshold for a determination time or longer, the controller 3 makes a final determination that the main power supply 10 has failed. If the controller 3 determines that the main power supply 10 has failed, it determines that the failure of the main power supply 10 detected by the failure detection device 30 is not an erroneous detection, in other words, it determines that the failure is a true failure.

[0046] On the other hand, if the voltage of the main power supply system line 70 remains higher than the ground fault threshold for a determination time or longer, the controller 3 officially determines that the main power supply 10 has not failed. If the controller 3 determines that the main power supply 10 has not failed, it determines that the failure of the main power supply 10 detected by the failure detection device 30 is an erroneous detection caused by a temporary voltage drop or the like. If the controller 3 determines that the main power supply 10 has not failed, it outputs a clear signal to the latch circuit 32, clearing the latch circuit 32 and stopping the output of the latch signal. This causes the backup switch 44 to return to its original state, i.e., the cut-off state.

[0047] As described above, in this embodiment, the latch circuit 32 connects the backup switch 44 in response to a latch signal. Upon receiving the latch signal, the controller 3 (microcomputer) determines whether the main power supply 10 has failed, and if it determines that the main power supply 10 has not failed, clears the latch circuit 32 and stops outputting the latch signal. This allows for a prompt transition to a backup state when a failure of the main power supply 10 is detected, while also ensuring that the backup state is maintained. In other words, if the main power supply 10 fails, the latch circuit 32 instantly outputs a latch signal, turning the backup switch 44 into a conductive state, enabling a prompt transition to the backup state. Furthermore, after outputting the latch signal, the latch circuit 32 continues to output the latch signal until it is cleared by the controller 3, thereby maintaining the backup state. This ensures that the backup state is maintained reliably.

[0048] As described above, the latch circuit 32 is cleared when it receives a clear signal from the controller 3. However, during this clearing process, the voltage of the main power supply system line 70 may again drop below the ground fault threshold, causing the main power supply 10 to fail. In such a case, the latch circuit 32 is in the process of clearing and therefore cannot receive a detection signal from the comparator 31 indicating a failure of the main power supply 10. Therefore, even though the main power supply 10 has failed, the latch circuit 32 cannot output a latch signal, and as a result, there is a risk that the latch circuit 32 may not be able to transition to a backup state in which the backup switch 44 is connected.

[0049] Therefore, in the controller 3 according to this embodiment, upon receiving the latch signal, a backup drive signal that drives (turns on) the backup switch 44 is output to the OR logic circuit 33. The OR logic circuit 33 outputs the backup drive signal from the controller 3 or the latch signal from the latch circuit 32 as a connection signal to the backup switch 44, thereby connecting the backup switch 44. After clearing the latch circuit 32, the controller 3 re-determines whether the main power supply 10 is normal or abnormal, and maintains or cancels the output of the backup drive signal depending on the determination result.

[0050] As a result, even if the voltage of the main power supply system line 70 drops below the ground fault threshold again during clearing processing in the latch circuit 32 and the main power supply 10 fails, it is possible to connect the backup switch 44 and continue the backup state.

[0051] The above processing will now be described in detail with reference to Figures 6A and 6B. Figures 6A and 6B are time charts of processing executed by the power supply control device 1 and the like. Figure 6A shows an example in which the main power supply 10 fails again during the clearing processing in the latch circuit 32. Figure 6B shows an example in which the main power supply 10 does not fail again.

[0052] 6A , when the voltage of the main power supply system line 70 falls below the ground fault threshold (see time T1), the comparator 31 detects (i.e., provisionally determines) a failure in the main power supply 10 and outputs a detection signal to the latch circuit 32. The latch circuit 32 latches the detection signal, outputs a latch signal, and connects the backup switch 44. The latch circuit 32 also outputs the latch signal to the controller 3.

[0053] Upon receiving the latch signal, the controller 3 outputs a backup drive signal that drives the backup switch 44 (see time T2). As a result, the backup drive signal and the latch signal are input to the OR logic circuit 33.

[0054] Furthermore, upon receiving the latch signal, the controller 3 executes a process (main determination) for determining whether the failure of the main power supply 10 is occurring. Specifically, the controller 3 determines whether the failure of the main power supply 10 detected by the failure detection device 30 (comparator 31) is an erroneous detection caused by a temporary voltage drop or the like. Here, the controller 3 checks whether the voltage of the main power supply system line 70 remains lower than the ground fault threshold for a determination time T or longer. The controller 3 also checks whether the voltage of the main power supply system line 70 remains higher than the ground fault threshold for a determination time T or longer. In FIG. 6A , the voltage of the main power supply system line 70 is equal to or lower than the ground fault threshold from time T1 to time T3, but the time T3-T1 during which the voltage remains lower than the ground fault threshold is shorter than the determination time T. Therefore, the controller 3 does not determine that the main power supply 10 has failed. However, the voltage of the main power supply system line 70 remains higher than the ground fault threshold for a determination time T or longer after time T3. Therefore, the controller 3 determines that the voltage of the main power supply system line 70 continues for the determination time T or more, and finally determines that there is no failure in the main power supply 10. In other words, the controller 3 finally determines that the failure of the main power supply 10 detected by the failure detection device 30 (comparator 31) is a false detection caused by a temporary voltage drop or the like, and that the main power supply 10 is normal (see time T4).

[0055] If the controller 3 determines that the main power supply 10 is normal and not failing, it outputs a clear signal (Lo signal) to the latch circuit 32, clearing the latch circuit 32 and stopping the output of the latch signal (see time T5). Here, it is assumed that, during the clearing process of the latch circuit 32, the voltage of the main power supply system line 70 drops below the ground fault threshold again, causing the main power supply 10 to fail (see time T6). At this time, the comparator 31 outputs a voltage drop detection signal at time T6, but because the latch circuit 32 is clearing, it cannot detect the detection signal from the comparator 31 and cannot output a latch signal (Hi signal). However, because the controller 3 has been outputting the backup drive signal since time T2, the backup switch 44 remains connected.

[0056] After clearing the latch circuit 32, the controller 3 again executes the process of determining whether the main power supply 10 is in a fault state. In other words, the controller 3 again determines whether the main power supply 10 (electric power system) is normal or abnormal.

[0057] If the voltage of the main power supply system line 70 remains below the ground fault threshold for a determination time T or longer, the controller 3 determines that the main power supply 10 has failed again, that is, determines that the main power supply 10 is abnormal (see time T7). If the controller 3 determines that the main power supply 10 is abnormal, it executes backup processing to maintain the output of the backup drive signal, in other words, it maintains the connection of the backup switch 44.

[0058] As a result, even if the voltage of the main power supply system line 70 again drops below the ground fault threshold value during clearing processing in the latch circuit 32 and the main power supply 10 fails, the backup switch 44 can be connected and the backup state can be continued.

[0059] Next, a case where the voltage of the main power supply system line 70 does not drop below the ground fault threshold again after the latch circuit 32 is cleared, i.e., a case where the main power supply 10 returns to a normal state from a temporary voltage drop, will be described with reference to FIG. 6B.

[0060] As shown in Figure 6B, at time T5, the controller 3 clears the latch circuit 32 and then again executes the process of determining whether the main power supply 10 has failed. If the voltage of the main power supply system line 70 remains higher than the ground fault threshold continuously for a determination time T or longer, the controller 3 determines that the main power supply 10 is normal (see time T7). If the controller 3 determines that the main power supply 10 is normal, it cancels the output of the backup drive signal; in other words, it turns off the backup switch 44 (see time T8). Accordingly, the controller 3 returns from the backup state to the normal state and executes normal processing.

[0061] As a result, in this embodiment, even if the failure of the main power supply 10 detected by the failure detection device 30 is a false detection caused by a temporary voltage drop or the like, it is possible to quickly return from the backup state to the normal processing state.

[0062] In the first embodiment, the controller 3 outputs the backup drive signal immediately upon receiving the latch signal, but this is not limiting. Specifically, the controller 3 may output the backup drive signal during the period from when the latch signal is received until when the clear signal is output.

[0063] [1-4. Processing Executed by the Controller of the Power Supply Control Device] Next, processing executed by the controller 3 of the power supply control device 1 according to the first embodiment will be described with reference to Fig. 7. Fig. 7 is a flowchart showing an example of processing executed by the controller 3 of the power supply control device 1 according to the first embodiment. Note that the processing shown in Fig. 7 is repeatedly executed every time a predetermined time period has elapsed, but is not limited to this.

[0064] 7, the controller 3 determines whether or not it has received a latch signal from the latch circuit 32 (step S101). More specifically, the voltage of the main power supply system line 70 falls below the ground fault threshold, causing the comparator 31 of the failure detection device 30 to output a detection signal, and the controller 3 determines whether or not it has received a latch signal from the latch circuit 32, which latches the detection signal. In other words, the controller 3 determines whether or not the failure detection device 30 has provisionally determined that a power supply failure has occurred. Note that this latch signal is also output to the backup switch 44 via the OR logic circuit 33, so the backup switch 44 is in a connected (conductive) state.

[0065] If the controller 3 determines that it has not received a latch signal from the latch circuit 32 (No in step S101), it skips the subsequent processing. On the other hand, if the controller 3 determines that it has received a latch signal from the latch circuit 32 (Yes in step S101), it outputs a backup drive signal that turns on the backup switch 44 (step S102).

[0066] Next, the controller 3 executes a main determination process to determine whether the main power supply 10 has failed (step S103). More specifically, the controller 3 determines whether the main power supply 10 has failed. Specifically, the controller 3 determines whether the voltage of the main power supply system line 70 is equal to or lower than the ground fault threshold for at least the determination time T, i.e., whether the main power supply 10 has failed. The controller 3 also determines whether the voltage of the main power supply system line 70 is higher than the ground fault threshold for at least the determination time T, i.e., whether the main power supply 10 is in a normal state with no failure.

[0067] Next, the controller 3 determines whether the determination result of step S103 was a failure of the main power supply 10 (step S104). If the controller 3 determines that the main power supply 10 has failed (step S104, Yes), it repeats the processing of step S104. As a result, if the controller 3 determines that the main power supply 10 has failed, it continues to output the backup drive signal output in step S102 until the main power supply 10 returns to normal (until the voltage of the main power supply system line 70 becomes higher than the ground fault threshold). In this case, the backup switch 44 is maintained in the connected state by both the latch signal output from the latch circuit 32 and the backup drive signal output from the controller 3, and fail-safe control is performed.

[0068] On the other hand, if the controller 3 determines that the main power supply 10 has not failed (No at step S104), the controller 3 outputs a clear signal to the latch circuit 32 (step S105). That is, the controller 3 clears the latch circuit 32 to stop outputting the latch signal.

[0069] Next, the controller 3 determines again whether the main power supply 10 has failed (step S106). In other words, the controller 3 determines again whether the main power supply 10 is normal or abnormal. Specifically, the controller 3 determines whether the voltage of the main power supply system line 70 is equal to or lower than the ground fault threshold for at least the determination time T, and whether the voltage of the main power supply system line 70 is higher than the ground fault threshold for at least the determination time T.

[0070] Next, the controller 3 determines whether the determination result of step S106 was a failure of the main power supply 10 (step S107). If the controller 3 determines that the main power supply 10 has not failed (step S107, No), that is, if the main power supply 10 is normal, it cancels the output of the backup drive signal (step S108). This stops the output of both the latch signal and the backup drive signal, and the backup switch 44 returns to its normal state (shut-off state).

[0071] On the other hand, if the controller 3 determines that the main power supply 10 has failed (Yes in step S107), that is, if the main power supply 10 is abnormal, it continues to output the backup drive signal (step S109). As a result, the output of the latch signal is stopped, but the controller 3 continues to output the backup drive signal, so the backup switch 44 remains connected and fail-safe control continues.

[0072] As described above, the power supply control device 1 according to the first embodiment includes a comparator 31, a latch circuit 32, and a controller 3 (an example of a microcomputer). The comparator 31 compares the voltage of the main power supply system line 70 (an example of a power system) to which power from the main power supply 10 is supplied with a ground fault threshold (an example of a threshold) to detect a failure in the main power supply system line 70 and output a detection signal. The latch circuit 32 latches the detection signal and outputs a latch signal. The latch signal drives a backup switch 44 (an example of a specific switch) that controls the power supply to a second load 102 (an example of a load). Upon receiving the latch signal, the controller 3 determines whether the detection of the failure in the main power supply system line 70 by the comparator 31 is correct. If the controller 3 determines that the main power supply system line 70 is not failed, the controller 3 clears the latch circuit 32 and stops outputting the latch signal. This allows the system to quickly transition to a backup state when a power supply failure is detected and to reliably maintain the backup state.

[0073] Specifically, the power supply control device 1 according to the first embodiment includes a backup switch 44, a comparator 31, a latch circuit 32, and a controller 3 (an example of a microcomputer). The backup switch 44 connects and disconnects a power path between a second load 102 (an example of a load) supplied with power from the main power supply 10 and the backup power supply 20. The comparator 31 compares the voltage of a main power supply system line 70 (an example of a power system) supplied with power from the main power supply 10 with a ground fault threshold (an example of a threshold) to detect a failure in the main power supply system line 70 and output a detection signal. The latch circuit 32 latches the detection signal and outputs a latch signal, which connects the backup switch 44. Upon receiving the latch signal, the controller 3 determines whether the comparator 31's detection of the failure in the main power supply system line 70 is correct. If the controller 3 determines that the main power supply system line 70 is not failing, the controller 3 clears the latch circuit 32 and stops outputting the latch signal. This allows the device to quickly transition to a backup state when a power supply failure is detected and to reliably maintain the backup state.

[0074] [2. Second embodiment] [2-1. Configuration of control system] Next, a control system 100 including a power supply control device 1a according to a second embodiment will be described with reference to Fig. 8. Fig. 8 is an explanatory diagram showing an example configuration of the control system 100 according to the second embodiment. Note that, in the following, components common to the first embodiment will be assigned the same reference numerals and descriptions thereof will be omitted.

[0075] The power supply control device 1a according to the second embodiment includes a controller 3, a backup power supply 20, a failure detection device 30, a first system line 110, a second system line 120, an inter-system line 130, an inter-system switch 151, a battery switch 152, and first to fifth switches 201 to 205.

[0076] The first system line 110 is a power supply line that supplies power from the main power supply 10 to a plurality of electrical loads. More specifically, the first system line 110 is a line that supplies power from the main power supply 10 to a first load 101, a second load 102, and a third load 103. In other words, the power supply system of the main power supply 10 includes the main power supply 10 and the first system line 110.

[0077] The second system line 120 is a power supply line that supplies power from the backup power source 20 to a plurality of electrical loads. More specifically, the second system line 120 is a line that supplies power from the backup power source 20 to the second load 102 and the third load 103. In other words, the power supply system of the backup power source 20 includes the backup power source 20 and the second system line 120. The inter-system line 130 is a connection line that electrically connects the first system line 110 and the second system line 120. The first load 101, the second load 102, and the third load 103 are examples of first loads. The second load 102 and the third load 103 are examples of second loads.

[0078] The failure detection device 30 according to the second embodiment detects a failure in the power supply system. Examples of failures in the power supply system include a ground fault in the first system line 110 including the main power supply 10, and a ground fault in the second system line 120 including the backup power supply 20. Therefore, the failure detection device 30 detects a failure in the main power supply 10 or the backup power supply 20. The detailed configuration of the failure detection device 30 will be described later with reference to FIG. 13 .

[0079] The inter-system switch 151 is a switch that can connect and disconnect (disconnect) the first system line 110 and the second system line 120. The inter-system switch 151 is controlled by the controller 3 and the failure detection device 30. For example, the inter-system switch 151 is turned on during normal operation including manual operation and automatic operation, and turned off in the event of a power supply failure. The on / off operation of the inter-system switch 151 by the controller 3 and the failure detection device 30 will be described in detail later.

[0080] The inter-system switch 151 may be a DC / DC converter. In this case, the DC / DC converter connects the first system line 110 and the second system line 120 by operating. The DC / DC converter cuts off the connection between the first system line 110 and the second system line 120 by stopping its operation. The battery switch 152 is a switch that can connect and cut off (disconnect) the backup power supply 20 and the second system line 120.

[0081] The first switch 201 is a switch that can connect and disconnect the first system line 110 and the first load 101. The second switch 202 is a switch that can connect and disconnect the first system line 110 and the second load 102. The third switch 203 is a switch that can connect and disconnect the first system line 110 and the third load 103.

[0082] The fourth switch 204 is a switch that can connect and disconnect the second system line 120 and the second load 102. The fifth switch 205 is a switch that can connect and disconnect the second system line 120 and the third load 103.

[0083] The power supply control device 1a also includes a first voltage sensor 51 and a second voltage sensor 52. The first voltage sensor 51 is provided on the first system line 110. The first voltage sensor 51 detects the voltage of the first system line 110 and outputs the detection result to the controller 3. The second voltage sensor 52 is provided on the second system line 120. The second voltage sensor 52 detects the voltage of the second system line 120 and outputs the detection result to the controller 3.

[0084] The controller 3 controls the operation of the system switch 151, the battery switch 152, the first to fifth switches 201 to 205, the fault detection device 30, etc. by having the CPU execute a program stored in the ROM using the RAM as a working area.

[0085] The controller 3 is mounted on a vehicle having an automatic driving function and performs fail-safe control to supply power from the backup power supply 20 to the load in the event of a failure of the main power supply 10. The controller 3 also performs fail-safe control to supply power from the main power supply 10 to the load in the event of a failure of the backup power supply 20.

[0086] [2-2. Example of Operation of Power Supply Control Device] Next, the operation of the power supply control device 1a according to the second embodiment will be described with reference to Figures 9 to 12. Figures 9 to 12 are explanatory diagrams showing an example of operation of the power supply control device 1a according to the second embodiment.

[0087] [2-2-1. Operation during normal driving] With the vehicle ignition switch turned on, when the vehicle is stopped under normal circumstances, during manual driving, or during automatic driving, and there is no failure in the power supply systems of the main power supply 10 and the backup power supply 20, the controller 3 controls the inter-system switch 151, the battery switch 152, and the first to fifth switches 201 to 205 as shown in FIG. 9 .

[0088] Specifically, the controller 3 turns on the inter-system switch 151. The controller 3 turns off the battery switch 152. The controller 3 turns on the first to fifth switches 201 to 205. This allows the power supply control device 1a to supply power from the main power supply 10 to the first load 101, the second load 102, and the third load 103 while suppressing discharge of the LiB 21 during normal operation.

[0089] [2-2-2. Operation in the Event of a Failure in the Power Supply System] In the control system 100 according to the second embodiment, the power supply system may fail due to a ground fault in the first system line 110 including the main power supply 10, or a ground fault in the second system line 120 including the backup power supply 20.

[0090] In the power supply control device 1a, if a ground fault occurs in the first system line 110 or the second system line 120 during normal operation, the voltages of the first system line 110 and the second system line 120 will become lower than the normal voltage.

[0091] For this reason, the failure detection device 30 detects that a failure has occurred in the power supply system when the voltage of the first system line 110 including the main power supply 10 falls below a preset ground fault threshold. Note that, because it is not possible to determine whether the detected power supply system failure is a failure of the main power supply 10 or the backup power supply 20, the failure detection device 30 can also be said to provisionally determine that a failure has occurred in the power supply system. Note that, for example, the failure detection device 30 may detect that a failure has occurred in the power supply system when the voltage of the second system line 120 falls below a ground fault threshold.

[0092] 10 , when a failure occurs in the power supply system, the inter-system switch 151 is turned off in response to a signal (latch signal, described later) output from the failure detection device 30 that detects the failure. This latch signal is also output to the controller 3. Upon receiving the latch signal, the controller 3 turns on the battery switch 152 and outputs a backup drive signal that turns off the inter-system switch 151.

[0093] This cuts off the connection between the first system line 110 and the second system line 120. Then, if there is no ground fault in the first system line 110, the power supply control device 1a becomes able to supply power from the main power supply 10. Also, if there is no ground fault in the second system line 120, the power supply control device 1a becomes able to supply power from the backup power supply 20.

[0094] After the malfunction detection device 30 detects a malfunction, the controller 3 monitors the first system voltage V1 and the second system voltage V2. The first system voltage V1 is the voltage of the first system line 110 detected by the first voltage sensor 51. The second system voltage V2 is the voltage of the second system line 120 detected by the second voltage sensor 52.

[0095] After the fault detection device 30 detects a fault (after a provisional judgment), if the second system voltage V2 is below the ground fault threshold continuously for a judgment time T or more and the first system voltage V1 recovers to exceed the ground fault threshold continuously for a judgment time T or more, the controller 3 makes a definitive judgment that there is a ground fault in the second system line 120.

[0096] In this case, the controller 3 performs fail-safe control to supply power from the main power supply 10 to the loads. Specifically, as shown in Fig. 11 , the controller 3 turns off the battery switch 152 while keeping the inter-system switch 151 off. The controller 3 also turns off the fourth switch 204 and the fifth switch 205. Then, the controller 3 supplies power from the main power supply 10 to the loads 101 to 103 via the first system line 110.

[0097] When the controller 3 determines that the backup power supply 20 has failed, for example, due to a ground fault in the second system line 120, it notifies the automatic operation control device 60 that the backup power supply 20 has failed and that fail-safe control by the main power supply 10 has begun.

[0098] When the automatic driving control device 60 is notified by the power supply control device 1a that fail-safe control using the main power supply 10 has begun, it begins automatic driving evacuation control (FOP), and, for example, drives the vehicle to a safe location and stops it.

[0099] In addition, after the fault detection device 30 detects a fault (after a provisional judgment), if the first system voltage V1 remains below the ground fault threshold for a continuous period of time T or more and the second system voltage V2 recovers to exceed the ground fault threshold for a continuous period of time T or more, the controller 3 makes a definitive judgment that a ground fault has occurred in the first system line 110.

[0100] In this case, the controller 3 performs fail-safe control to supply power from the backup power supply 20 to the load. Specifically, as shown in Fig. 12 , the controller 3 keeps the inter-system switch 151 off and the battery switch 152 on, turns off the first to third switches 201 to 203, and supplies power from the backup power supply 20 to the second load 102 and the third load 103 via the second system line 120.

[0101] If the controller 3 determines that the main power supply 10 has failed due to a ground fault in the first system line 110 or the like, it notifies the automatic driving control device 60 that the main power supply 10 has failed and that fail-safe control by the backup power supply 20 has begun.

[0102] When the automatic driving control device 60 is notified by the power supply control device 1a that fail-safe control using the backup power supply 20 has begun, it starts automatic driving evacuation control (FOP), and, for example, drives the vehicle to a safe location and stops it.

[0103] [2-3. Example of the configuration of the malfunction detection device] Next, an example of the configuration of the malfunction detection device 30 of the power supply control device 1a according to the second embodiment will be described with reference to Fig. 13. Fig. 13 is a diagram showing an example of the configuration of the malfunction detection device 30 according to the second embodiment.

[0104] As shown in Fig. 13, the failure detection device 30 includes a comparator 31, a latch circuit 32, and an OR logic circuit 33. The comparator 31 detects a failure of the main power supply 10 or the backup power supply 20 and outputs a detection signal. Specifically, the comparator 31 is a comparator that compares the voltage (first system voltage V1) of the first system line 110 including the main power supply 10 with a ground fault threshold. When the voltage of the first system line 110 falls below the ground fault threshold, the comparator 31 detects a failure of the main power supply 10 or the backup power supply 20 (i.e., a failure of the power supply system) and outputs a detection signal to the latch circuit 32. In other words, the comparator 31 makes a tentative determination of a power supply failure.

[0105] Although the above example shows the comparator 31 comparing the voltage of the first system line 110 with the ground fault threshold, the present invention is not limited to this. That is, the comparator 31 may compare the voltage of the second system line 120 (second system voltage V2) with the ground fault threshold, and detect that a fault has occurred in the power supply system when the voltage of the second system line 120 becomes equal to or lower than the ground fault threshold. In this way, the comparator 31 compares the voltage of the power system including the first system line 110 and the second system line 120 with the ground fault threshold (an example of a threshold), detects a fault in the power system, and outputs a detection signal.

[0106] The latch circuit 32 latches (holds) the detection signal input from the comparator 31 and outputs the latch signal to the OR logic circuit 33. The OR logic circuit 33 outputs the latch signal from the latch circuit 32 as a shutoff signal to the inter-system switch 151, thereby shutting off the inter-system switch 151. That is, the latch circuit 32 drives (turns off) the inter-system switch 151 via the OR logic circuit 33 by the latch signal.

[0107] As described above, the failure detection device 30 according to the second embodiment is configured by a hardware circuit including the comparator 31 and the latch circuit 32. As a result, in the second embodiment, when a failure is detected in the main power supply 10 or the backup power supply 20, the inter-system switch 151 can be quickly driven (shut off). In other words, in the second embodiment, when a failure in the power supply system is detected, the system can quickly transition to the backup state.

[0108] Latch circuit 32 also outputs a latch signal to controller 3. Upon receiving the latch signal, controller 3 makes a final determination of the failure state of main power supply 10 and backup power supply 20. More specifically, controller 3 makes a final determination as to whether the failure of main power supply 10 or backup power supply 20 detected by failure detection device 30 is a true failure or an erroneous detection caused by a temporary voltage drop or the like. In other words, controller 3 makes a final determination as to whether the detection of the power system failure by comparator 31 is correct.

[0109] For example, the controller 3 determines, based on the output of the first voltage sensor 51 (see FIG. 8 ), whether the first system voltage V1 remains below the ground fault threshold for a period of time T or longer. In other words, the controller 3 determines whether the power supply system including the main power supply 10 has failed. Furthermore, the controller 3 determines, based on the output of the second voltage sensor 52 (see FIG. 8 ), whether the second system voltage V2 remains below the ground fault threshold for a period of time T or longer. In other words, the controller 3 determines whether the power supply system including the backup power supply 20 has failed.

[0110] If the controller 3 determines that at least one of the first system voltage V1 and the second system voltage V2 remains below the ground fault threshold for a period of time T or longer and that the power supply system has failed, the controller 3 determines that the failure in the power supply system detected by the failure detection device 30 is not a false detection, in other words, that it is a true failure.

[0111] On the other hand, if both the first system voltage V1 and the second system voltage V2 remain higher than the ground fault threshold for a period of time equal to or longer than the determination time T, the controller 3 determines that there is no failure in the main power supply 10 and the backup power supply 20. If the controller 3 determines that there is no failure, it determines that the failure in the power supply system detected by the failure detection device 30 is an erroneous detection caused by a temporary voltage drop or the like. If the controller 3 determines that there is no failure in the power supply system including the main power supply 10 and the backup power supply 20, it outputs a clear signal to the latch circuit 32, clearing the latch circuit 32 and stopping the output of the latch signal.

[0112] As described above, in the second embodiment, the latch circuit 32 shuts off the inter-system switch 151 in response to a latch signal. Upon receiving the latch signal, the controller 3 (microcomputer) determines whether the power supply system including the main power supply 10 and the backup power supply 20 has failed. If the controller 3 determines that the power supply system has not failed, the controller 3 clears the latch circuit 32 and stops outputting the latch signal. This allows the system to quickly transition to a backup state when a failure of the power supply system including the main power supply 10 and the backup power supply 20 is detected, and also ensures that the backup state is maintained. In other words, if the main power supply 10 fails, the latch circuit 32 instantly outputs a latch signal, shutting off the inter-system switch 151, thereby enabling a quick transition to the backup state. Furthermore, after outputting the latch signal, the latch circuit 32 continues to output the latch signal until it is cleared by the controller 3, thereby maintaining the backup state. This ensures that the backup state is maintained.

[0113] As described above, the latch circuit 32 is cleared when it receives a clear signal from the controller 3. However, during this clearing process, the first system voltage V1 (or the second system voltage V2) may again drop below the ground fault threshold, causing a power supply system failure. In such a case, the latch circuit 32 is in the process of clearing and therefore cannot receive a detection signal from the comparator 31 indicating a power supply system failure. Therefore, even though the power supply system has failed, the latch circuit 32 cannot output a latch signal, and as a result, there is a risk that the latch circuit 32 may not be able to transition to a backup state in which the inter-system switch 151 is shut off.

[0114] Therefore, in the controller 3 according to the second embodiment, upon receiving the latch signal, a backup drive signal for driving (cutting off) the inter-system switch 151 is output to the OR logic circuit 33. The OR logic circuit 33 outputs the backup drive signal from the controller 3 or the latch signal from the latch circuit 32 as a cutoff signal to the inter-system switch 151, thereby cutting off the inter-system switch 151. After clearing the latch circuit 32, the controller 3 re-determines whether the main power supply 10 and the backup power supply 20 (power systems) are normal or abnormal, and maintains or cancels the output of the backup drive signal depending on the determination result.

[0115] As a result, even if the voltage of the first system voltage V1 (or the second system voltage V2) drops below the ground fault threshold again during the clearing process in the latch circuit 32 and the power supply system fails, it is possible to shut off the inter-system switch 151 and continue the backup state.

[0116] The above processing will now be described in detail with reference to Figures 14A and 14B. Figures 14A and 14B are time charts of processing executed by the power supply control device 1a and the like according to the second embodiment. Note that Figure 14A shows an example in which the power supply system (here, the main power supply 10) fails again during the clearing processing in the latch circuit 32. Figure 14B shows an example in which the main power supply 10 does not fail again.

[0117] 14A , for example, when the first system voltage V1, which is the voltage of the first system line 110, falls below the ground fault threshold (see time T11), the comparator 31 detects a failure of the main power supply 10 or the backup power supply 20 and outputs a detection signal (tentative determination) to the latch circuit 32. The latch circuit 32 latches the detection signal, outputs a latch signal, and turns off the inter-system switch 151. The latch circuit 32 also outputs the latch signal to the controller 3.

[0118] Upon receiving the latch signal, the controller 3 outputs a backup drive signal that shuts off the inter-system switch 151 (see time T12). As a result, the backup drive signal and the latch signal are input to the OR logic circuit 33.

[0119] Furthermore, upon receiving the latch signal, the controller 3 monitors the first system voltage V1 and the second system voltage V2, and performs a main determination to determine whether the main power supply 10 and the backup power supply 20 are faulty (see time T11). That is, if the first system voltage V1 is equal to or less than the ground fault threshold for at least the determination time T, and the second system voltage V2 recovers to exceed the ground fault threshold for at least the determination time T, the controller 3 performs a main determination that a ground fault has occurred in the first system line 110 including the main power supply 10. Furthermore, if the second system voltage V2 is equal to or less than the ground fault threshold for at least the determination time T, and the first system voltage V1 recovers to exceed the ground fault threshold for at least the determination time T, the controller 3 performs a main determination that a ground fault has occurred in the second system line 120 including the backup power supply 20. Furthermore, if the first system voltage V1 and the second system voltage V2 both recover to exceed the ground fault threshold for the judgment time T or longer, the controller 3 determines that the first system line 110 and the second system line 120 are both normal, that is, the failure in the power supply system detected by the failure detection device 30 is an erroneous detection caused by a temporary voltage drop or the like.

[0120] 14A , the first system voltage V1 is equal to or less than the ground fault threshold from time T11 to time T14, but the time T14-T11 during which the first system voltage V1 is equal to or less than the ground fault threshold is shorter than the determination time T. Therefore, the controller 3 does not determine that the first system line 110 has a ground fault. On the other hand, the first system voltage V1 exceeds the ground fault threshold for at least the determination time T after time T14. Therefore, the controller 3 determines that the first system line 110 is normal.

[0121] 14A , the second system voltage V2 is equal to or less than the ground fault threshold from time T11 to time T13, but the time T13-T11 during which the second system voltage V2 is equal to or less than the ground fault threshold is shorter than the determination time T. Therefore, the controller 3 does not determine that the second system line 120 has a ground fault. On the other hand, the second system voltage V2 exceeds the ground fault threshold for at least the determination time T after time T13. Therefore, the controller 3 determines that the second system line 120 is normal.

[0122] Therefore, the controller 3 determines in the main determination made after time T11 that both the first system line 110 and the second system line 120 are normal (time T15).

[0123] If the controller 3 determines that neither the main power supply 10 nor the backup power supply 20 has failed and is normal, it outputs a clear signal to the latch circuit 32, clearing the latch circuit 32 and stopping the output of the latch signal (see time T16). Here, it is assumed that during the clearing process of the latch circuit 32, the first system voltage V1 falls again below the ground fault threshold, causing the main power supply 10 to fail (see time T17).

[0124] After clearing the latch circuit 32, the controller 3 again executes the process of determining whether the main power supply 10 and the backup power supply 20 are in a fault state. In other words, the controller 3 again determines whether the main power supply 10 and the backup power supply 20 are normal or abnormal.

[0125] The controller 3 determines that the backup power supply 20 is normal if the second system voltage V2 exceeds the ground fault threshold for at least the determination time T. Furthermore, the controller 3 determines that the main power supply 10 has failed again if the first system voltage V1 is equal to or less than the ground fault threshold for at least the determination time T, i.e., determines that the backup power supply 20 is normal and the main power supply 10 is abnormal (see time T18). If the controller 3 determines that the main power supply 10 is abnormal, it executes backup processing to maintain the output of the backup drive signal; in other words, it maintains the shutoff of the inter-system switch 151.

[0126] Furthermore, although not shown, the controller 3 determines that the backup power supply 20 has failed, that is, that there is an abnormality in the backup power supply 20, when the first system voltage V1 exceeds the ground fault threshold for the determination time T or more and the second system voltage V2 is equal to or less than the ground fault threshold for the determination time T or more. If the controller 3 determines that there is an abnormality in the backup power supply 20, the controller 3 maintains the output of the backup drive signal, in other words, maintains the shutoff of the inter-system switch 151.

[0127] As a result, even if the first system voltage V1 (or the second system voltage V2) falls below the ground fault threshold again during the clearing process in the latch circuit 32, causing the power supply system to fail, the inter-system switch 151 can be shut off and the backup state can be continued.

[0128] Next, a case where the first system voltage V1 does not drop below the ground fault threshold again after the latch circuit 32 is cleared, i.e., a case where the main power supply 10 returns to a normal state from a temporary voltage drop, will be described with reference to FIG. 14B.

[0129] As shown in FIG. 14B , at time T16, the controller 3 clears the latch circuit 32 and then again executes the process of determining whether the main power supply 10 and the backup power supply 20 are faulty. If both the first system voltage V1 and the second system voltage V2 remain higher than the ground fault threshold for at least the determination time T, the controller 3 determines that both the power supply system including the main power supply 10 and the power supply system including the backup power supply 20 are normal (see time T18). If the controller 3 determines that both power supply systems are normal, it cancels the output of the backup drive signal; in other words, it closes the inter-system switch 151 (see time T19). The controller 3 also shuts off the battery switch 152. Accordingly, the controller 3 returns from the backup state to the normal state and executes normal processing.

[0130] In the above example, the latch signal output from the failure detection device 30 and the backup drive signal output from the controller 3 are used as signals to drive the inter-system switch 151, but this is not limiting. For example, as shown by the phantom lines in FIG. 13 , the failure detection device 30 may output the latch signal and / or the backup drive signal to the battery switch 152 via the OR logic circuit 33. That is, the battery switch 152 becomes conductive in response to the latch signal and the backup drive signal. More specifically, the OR logic circuit 33 makes the battery switch 152 conductive (connected) by outputting the latch signal from the latch circuit 32 or the backup drive signal from the controller 3 as a connection signal to the battery switch 152.

[0131] In this way, battery switch 152 is turned on in response to the latch signal and the backup drive signal, so that when a failure is detected in main power supply 10 or backup power supply 20, battery switch 152 can be driven (turned on) early. In other words, when a failure in the power supply system is detected, the system can quickly transition to the backup state.

[0132] In the second embodiment, the controller 3 outputs the backup drive signal immediately upon receiving the latch signal, but this is not limiting. Specifically, the controller 3 may output the backup drive signal during the period from when the latch signal is received until when the clear signal is output.

[0133] [2-4. Processing Executed by the Controller of the Power Supply Control Device] Next, processing executed by the controller 3 of the power supply control device 1a according to the second embodiment will be described with reference to Fig. 15. Fig. 15 is a flowchart showing an example of processing executed by the controller 3 of the power supply control device 1a according to the second embodiment. Note that the processing shown in Fig. 15 is repeatedly executed every time a predetermined time period has elapsed, but is not limited to this.

[0134] 15 , the controller 3 determines whether or not it has received a latch signal from the latch circuit 32 (step S201). More specifically, when the voltage of the first system voltage V1 (or the second system voltage V2) falls below the ground fault threshold, the comparator 31 of the failure detection device 30 outputs a detection signal, and the controller 3 determines whether or not it has received a latch signal from the latch circuit 32 that latches the detection signal. In other words, the controller 3 determines whether or not the failure detection device 30 has provisionally determined that a power supply failure has occurred. Note that this latch signal is also output to the inter-system switch 151 via the OR logic circuit 33, so that the inter-system switch 151 is in an OFF state.

[0135] If the controller 3 determines that it has not received a latch signal from the latch circuit 32 (step S201, No), it skips the subsequent processing. On the other hand, if the controller 3 determines that it has received a latch signal from the latch circuit 32 (step S201, Yes), it outputs a backup drive signal that turns off the backup switch and turns on the battery switch 152 (step S202).

[0136] Next, the controller 3 monitors the first system voltage V1 and the second system voltage V2, and executes a main determination process to determine whether the fault detected by the fault detection device 30 is a ground fault in the first system line 110, a ground fault in the second system line 120, or whether both system lines are normal (step S203). Specifically, the controller 3 main determines that there is a ground fault in the second system line 120 when the second system voltage V2 is equal to or less than the ground fault threshold for at least the determination time T and the first system voltage V1 has recovered to exceed the ground fault threshold for at least the determination time T. The controller 3 main determines that there is a ground fault in the first system line 110 when the first system voltage V1 is equal to or less than the ground fault threshold for at least the determination time T and the second system voltage V2 has recovered to exceed the ground fault threshold for at least the determination time T. The controller 3 main determines that there is a ground fault in the first system line 110 when the first system voltage V1 is equal to or less than the ground fault threshold for at least the determination time T and the second system voltage V2 has recovered to exceed the ground fault threshold for at least the determination time T. The controller 3 main determines that there is a ground fault in the first system line 110 when both the first system voltage V1 and the second system voltage V2 have recovered to exceed the ground fault threshold for at least the determination time T.

[0137] Next, the controller 3 determines whether the determination result in step S203 was a failure of the main power supply 10 or the backup power supply 20 (step S204).

[0138] If the controller 3 determines that the main power supply 10 or the backup power supply 20 has failed (Yes in step S204), it repeats the processing of step S204. As a result, when the controller 3 determines that the main power supply 10 or the backup power supply 20 has failed, it continues to output the backup drive signal that it output in step S202. In this case, the inter-system switch 151 is maintained in the cut-off state by both the latch signal output from the latch circuit 32 and the backup drive signal output from the controller 3, and fail-safe control is performed.

[0139] On the other hand, if the controller 3 determines that the main power supply 10 and the backup power supply 20 have not failed (No at step S204), the controller 3 outputs a clear signal to the latch circuit 32 (step S205). That is, the controller 3 clears the latch circuit 32 to stop outputting the latch signal.

[0140] Next, the controller 3 determines again whether the main power supply 10 and the backup power supply 20 have failed (step S206). In other words, the controller 3 determines again whether the main power supply 10 and the backup power supply 20 are normal or abnormal.

[0141] Next, the controller 3 determines whether the determination result of step S206 indicated a failure in at least one of the main power supply 10 and the backup power supply 20 (step S207). If the controller 3 determines that neither the main power supply 10 nor the backup power supply 20 has failed (step S207, No), that is, if the main power supply 10 and the backup power supply 20 are normal, the controller 3 cancels the output of the backup drive signal and cuts off the battery switch 152 (step S208). As a result, the output of both the latch signal and the backup drive signal is stopped, and the inter-system switch 151 returns to its normal state (conducting state). The battery switch 152 also returns to its normal state (cutting state).

[0142] On the other hand, if the controller 3 determines that the main power supply 10 or the backup power supply 20 has failed (step S207, Yes), that is, if the main power supply 10 or the backup power supply 20 is abnormal, it continues to output the backup drive signal (step S209).

[0143] As described above, the power supply control device 1a according to the second embodiment includes an inter-system switch 151, a comparator 31, a latch circuit 32, and a controller 3 (an example of a microcomputer). The inter-system switch 151 connects and disconnects a first system (first system line 110) that supplies power from the main power supply 10 to a first load and a second system (second system line 120) that supplies power from the backup power supply 20 to a second load. The comparator 31 compares the voltage of the power system including the first and second systems with a threshold value to detect a failure in the power system and output a detection signal. The latch circuit 32 latches the detection signal and outputs a latch signal, which disconnects the inter-system switch 151. Upon receiving the latch signal, the controller 3 determines whether the detection of the power system failure by the comparator 31 is correct. If the controller 3 determines that the power system does not have a failure, it clears the latch circuit 32 and stops outputting the latch signal. This allows the system to quickly transition to a backup state when a power supply failure is detected, and also ensures that the backup state is maintained.

[0144] [3. Supplementary Note] The features of the present invention are as follows: (1) A power supply control device comprising: a comparator that compares the voltage of an electric power system to which power from a main power supply is supplied with a threshold value to detect a failure in the electric power system and output a detection signal; a latch circuit that latches the detection signal, outputs a latch signal, and drives a specific switch that controls power supply to a load using the latch signal; and a microcomputer that, upon receiving the latch signal, determines whether the detection of the failure in the electric power system by the comparator is correct, and clears the latch circuit to stop output of the latch signal if it determines that the electric power system is not failing. (2) The power supply control device according to (1), wherein, upon receiving the latch signal, the microcomputer outputs a backup drive signal that drives the specific switch, determines whether the detection of the power system failure by the comparator is correct, and if it determines that the power system has not failed, clears the latch circuit and then re-determines whether the power system is normal or abnormal, and if it determines that the power system is abnormal, maintains the output of the backup drive signal, and if it determines that the power system is normal, cancels the output of the backup drive signal. (3) A power supply control device comprising: a backup switch that connects and disconnects a power path between a load supplied with power from a main power supply and a backup power supply; a comparator that compares the voltage of a power system that receives power from the main power supply with a threshold value to detect a failure in the power system and output a detection signal; a latch circuit that latches the detection signal, outputs a latch signal, and connects the backup switch based on the latch signal; and a microcomputer that, upon receiving the latch signal, determines whether the comparator's detection of the failure in the power system is correct, and clears the latch circuit to stop output of the latch signal if it determines that the power system is not failing.(4) The power supply control device according to (3), wherein, upon receiving the latch signal, the microcomputer outputs a backup drive signal that turns on the backup switch, determines whether the detection of the power system failure by the comparator is correct, and if it determines that the power system has not failed, clears the latch circuit and then re-determines whether the power system is normal or abnormal, and if it determines that the power system is abnormal, maintains the output of the backup drive signal, and if it determines that the power system is normal, cancels the output of the backup drive signal. (5) A power supply control device comprising: an inter-system switch that connects and disconnects a first system that supplies power from a main power supply to a first load and a second system that supplies power from a backup power supply to a second load; a comparator that compares the voltage of a power system including the first system and the second system with a threshold value to detect a failure in the power system and output a detection signal; a latch circuit that latches the detection signal, outputs a latch signal, and disconnects the inter-system switch based on the latch signal; and a microcomputer that, upon receiving the latch signal, determines whether the detection of the failure in the power system by the comparator is correct, and clears the latch circuit to stop output of the latch signal if it determines that the power system is not failing. (6) The power supply control device according to (5), wherein the microcomputer, upon receiving the latch signal, outputs a backup drive signal that shuts off the inter-system switch, determines whether the detection of a failure in the power system by the comparator is correct, and if it determines that the power system is not failing, clears the latch circuit and then re-determines whether the power system is normal or abnormal, and if it determines that the power system is abnormal, maintains output of the backup drive signal, and if it determines that the power system is normal, cancels output of the backup drive signal. (7) The power supply control device according to (6), further comprising a battery switch that connects the backup power source to the second system, and the battery switch is turned on in response to the latch signal and the backup drive signal.

[0145] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents.

[0146] REFERENCE SIGNS LIST 1, 1a Power supply control device 3 Controller 10 Main power supply 20 Backup power supply 30 Failure detection device 31 Comparator 32 Latch circuit 44 Backup switch 151 Inter-system switch 152 Battery switch

Claims

1. A power supply control device comprising: a comparator which detects a failure in an electric power system by comparing the voltage of the electric power system to which power from a main power supply is supplied with a threshold value and outputs a detection signal; a latch circuit which latches the detection signal and outputs a latch signal, and drives a specific switch which controls the supply of power to a load using the latch signal; and a microcomputer which, upon receiving the latch signal, determines whether the detection of the failure in the electric power system by the comparator is correct, and if it determines that there is no failure in the electric power system, clears the latch circuit and stops the output of the latch signal.

2. The power supply control device according to claim 1, wherein, upon receiving the latch signal, the microcomputer outputs a backup drive signal for driving the specific switch, determines whether the detection of the failure of the power system by the comparator is correct, and if it determines that the power system has not failed, clears the latch circuit and then re-determines whether the power system is normal or abnormal, maintains the output of the backup drive signal if it determines that the power system is abnormal, and cancels the output of the backup drive signal if it determines that the power system is normal.

3. A power supply control device comprising: a backup switch which connects and cuts off a power path between a load supplied with power from a main power supply and a backup power supply; a comparator which compares the voltage of a power system supplied with power from the main power supply with a threshold value to detect a failure in the power system and output a detection signal; a latch circuit which latches the detection signal and outputs a latch signal, and connects the backup switch in response to the latch signal; and a microcomputer which, upon receiving the latch signal, determines whether the detection of the failure in the power system by the comparator is correct, and if it determines that there is no failure in the power system, clears the latch circuit and stops output of the latch signal.

4. The power supply control device according to claim 3, wherein, upon receiving the latch signal, the microcomputer outputs a backup drive signal for making the backup switch conductive, determines whether the detection of the failure of the power system by the comparator is correct, and if it determines that the power system has not failed, clears the latch circuit and then re-determines whether the power system is normal or abnormal, maintains the output of the backup drive signal if it determines that the power system is abnormal, and cancels the output of the backup drive signal if it determines that the power system is normal.

5. A power supply control device comprising: an inter-system switch for connecting and disconnecting a first system that supplies power from a main power supply to a first load, and a second system that supplies power from a backup power supply to a second load; a comparator that compares the voltage of a power system including the first system and the second system with a threshold value to detect a failure in the power system and output a detection signal; a latch circuit that latches the detection signal, outputs a latch signal, and disconnects the inter-system switch based on the latch signal; and a microcomputer that, upon receiving the latch signal, determines whether the detection of the failure in the power system by the comparator is correct, and clears the latch circuit to stop output of the latch signal if it is determined that there is no failure in the power system.

6. The power supply control device according to claim 5, wherein, upon receiving the latch signal, the microcomputer outputs a backup drive signal for cutting off the inter-system switch, determines whether the detection of the failure of the power system by the comparator is correct, and if it determines that the power system has not failed, clears the latch circuit and then re-determines whether the power system is normal or abnormal, maintains the output of the backup drive signal if it determines that the power system is abnormal, and cancels the output of the backup drive signal if it determines that the power system is normal.

7. The power supply control device according to claim 6, further comprising a battery switch that connects the backup power supply to the second system, the battery switch being turned on in response to the latch signal and the backup drive signal.

Images